diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2012-02-01 16:00:38 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2012-02-01 16:00:38 -0800 |
| commit | ce106ad31016b5da1168496cd0454a6290555f84 (patch) | |
| tree | 07127240fcbe41ed0e2169ec2bbb79d67375b00d /lib/mpi/mpi-div.c | |
| parent | 18d3e0d7507949d776e50667d0a4e44b13d3e1ac (diff) | |
| parent | a99e7e5f36c55e561a64280f5099078c31839076 (diff) | |
| download | linux-ce106ad31016b5da1168496cd0454a6290555f84.tar.bz2 | |
Merge branch 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
* 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
lib: Fix 32-bit sparc udiv_qrnnd() definition in mpilib's longlong.h
lib: Fix multiple definitions of clz_tab
lib/digsig: checks for NULL return value
lib/mpi: added missing NULL check
lib/mpi: added comment on divide by 0 case
lib/mpi: check for possible zero length
lib/digsig: pkcs_1_v1_5_decode_emsa cleanup
lib/digsig: additional sanity checks against badly formated key payload
lib/mpi: removed unused functions
lib/mpi: checks for zero divisor length
lib/mpi: return error code on dividing by zero
lib/mpi: replaced MPI_NULL with normal NULL
lib/mpi: added missing NULL check
Diffstat (limited to 'lib/mpi/mpi-div.c')
| -rw-r--r-- | lib/mpi/mpi-div.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/lib/mpi/mpi-div.c b/lib/mpi/mpi-div.c index c3087d1390ce..f68cbbb4d4a4 100644 --- a/lib/mpi/mpi-div.c +++ b/lib/mpi/mpi-div.c @@ -149,6 +149,9 @@ int mpi_tdiv_qr(MPI quot, MPI rem, MPI num, MPI den) mpi_ptr_t marker[5]; int markidx = 0; + if (!dsize) + return -EINVAL; + memset(marker, 0, sizeof(marker)); /* Ensure space is enough for quotient and remainder. @@ -207,6 +210,8 @@ int mpi_tdiv_qr(MPI quot, MPI rem, MPI num, MPI den) * numerator would be gradually overwritten by the quotient limbs. */ if (qp == np) { /* Copy NP object to temporary space. */ np = marker[markidx++] = mpi_alloc_limb_space(nsize); + if (!np) + goto nomem; MPN_COPY(np, qp, nsize); } } else /* Put quotient at top of remainder. */ |